Privacy Policy

MARGIN computes daily contribution margin and profit for e-commerce shops. To do that it reads your shop's orders and your advertising spend. This policy explains what we collect, why, who else sees it, how long we keep it, and how to have it deleted. It applies to the website and the application at https://margin.theshop.global.

What we collect

Your account

• Your name and email address.
• A hash of your password, if you register with one. We never store the password itself.
• If you sign in with Google or Slack: the identifier that provider gives your account, and the name and email address it shares. We ask for nothing else from your Google or Slack account.
• Your workspace, its settings (currency, timezone) and what each member is permitted to do.

Your shop's data

When you connect a shop, we read from it with read-only access and store what the reports need: orders (amounts, currency, exchange rate, status and dates), their line items (products, SKUs, quantities, prices and costs), and your product catalog.

We do not store your customers' names, email addresses, phone numbers or postal addresses. To tell new customers from returning ones we keep only a one-way hash of each customer's email address, salted separately for every workspace, from which the address cannot be read back.

Costs you enter

Fixed costs, manufacturing and fulfilment costs, and ad spend you type in yourself.

Advertising accounts you connect

If you connect Meta (Facebook) or Google Ads, you authorise us through that platform's own sign-in to read your ad accounts. We store each account's identifier, name, currency and status, the daily spend of each account, and the access or refresh token that lets us read it. Tokens are encrypted at rest. We read spend totals only: we do not read your audiences or creatives, and we never create, change, pause or delete a campaign.

AI clients you connect

You can connect an AI assistant (an MCP client such as Claude) to your workspace. For every tool call it makes we keep an audit log: which tool, the request it sent, the response (cut to a bounded size), when, and the IP address it came from. You can see this log in the application. If you use the tool that writes texts to your shop (product, category or the shop's own wording), we keep the text before and after each change so it can be undone.

Feed audits on the website

If you paste a product feed URL into the audit on our website, we store the URL, the result and your IP address, to limit abuse.

Cookies and logs

We set only the cookies the application needs to work: a session cookie that keeps you signed in and a security token that protects forms. We use no analytics, advertising or tracking cookies, so there is no consent banner. Your signed-in session records the IP address and browser it was started from, and our servers keep ordinary technical logs, to run and secure the service.

How we use it

Only to provide MARGIN to you: to compute and show your figures, answer your AI client's requests, keep the service secure, and contact you about your account. We do not sell your data, we do not use it for advertising, and we do not use it to train AI models.

Google user data

MARGIN uses Google sign-in (your name, email address and Google account identifier) to let you log in, and the Google Ads API to read the daily cost of the Google Ads accounts you select. That data is used only to show your ad spend and the margin after it inside your own workspace. It is not shared with anyone else, not used for advertising, and not read by people except when you ask us to help with a problem, for security, or where the law requires it.

MARGIN's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Legal bases

Under the EU General Data Protection Regulation we process your account data because we need it to provide the service you signed up for (Article 6(1)(b)), and security logs and audit trails because we have a legitimate interest in keeping the service and your shop safe (Article 6(1)(f)).

For data about your shop's customers, you are the controller and we process it on your behalf, only to provide the service to you.

Who else sees it

• Our hosting provider, which runs our servers in the European Union.
• The platforms you connect — your shop platform, Google, Meta, Slack — receive our requests for your data under their own terms and privacy policies.
• The AI client you connect receives whatever its tool calls return. You choose that client, and what it does with the data is governed by its own terms.
• Authorities, only where the law requires us to disclose it.

Everyone in your workspace sees your workspace's data, limited to what its owner has permitted them.

Where it is stored

Your data is stored on servers in the European Union. The platforms you connect may process data elsewhere under their own terms.

How long we keep it

As long as your account and workspace exist. Disconnecting an ad platform deletes its stored tokens and account details at once; the daily spend already imported stays in your reports until you delete it or the workspace. Revoking an AI client stops its access at once.

Deleting your data

• To stop us reading an ad platform, disconnect it on the Connections page.
• You can also remove MARGIN's access from the platform's side: in your Google Account under Third-party apps & services, or in your Facebook settings under Business integrations.
• To delete your account or your whole workspace and everything imported into it, email get@theshop.dev from the address on the account. We delete it within 30 days and confirm when it is done.

Your rights

You can ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable format. You can also complain to the data protection authority where you live or work.

Security

Connections are encrypted in transit. Access and refresh tokens are encrypted at rest. Shop access is read-only except for the product, category and shop texts you explicitly choose to write. Every workspace is isolated from every other, and members can do only what their owner has permitted.

Changes

If we change this policy we update the date at the top. If a change materially affects how we use your data, we tell you before it takes effect.

Contact

MARGIN is operated by theshop s. r. o., Na Bráne 4, 010 01 Žilina, Slovakia, company ID 53 593 979.

Questions, requests about your data, or anything else about these terms: get@theshop.dev.